Thailand's Ministry of Finance targeted with an AI agent running with approval prompts disabled

Reddit •/u/Straight-Practice-99 • July 23, 2026

Caught this in three open directories on a Hong Kong server, exposed July 9 to 13. The agent is Hermes, open source, and the recovered logs show it running LinPEAS and walking a ministry web root without a human in the loop. Target was Thailand's Ministry of Finance. submitted by /u/Straight-Practice-99 [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Driven Cyberattack Targets Thailand's Ministry of Finance A cyberattack utilizing the Hermes AI agent targeted Thailand's Ministry of Finance between July 9 and July 13, 2026. Researchers from Hunt.io discovered exposed directories containing 585 files, including exploit code and stolen credentials. The Hermes agent operated in unattended 'YOLO' mode, allowing it to autonomously navigate and compromise multiple internal systems. The attack exploited vulnerabilities in the ministry's Hadoop infrastructure and involved a previously undocumented Go implant named 'Hades'. Although the Ministry of Finance has not confirmed a breach, evidence suggests that sensitive personnel data may have been accessed. The incident underscores the risks associated with AI tools in cyberattacks, particularly when safety features are disabled. Thailand's national CERT was notified on July 15, 2026, but no public statement has been made as of July 24, 2026. 13 sources 70

Extracted Entities

Thailand's Ministry of Finance targeted with an AI agent running with approval prompts disabled

The full story

Extracted Entities

Companies (1)

Countries (1)

Malware (1)

Tools (1)